1 files changed, 119 insertions, 11 deletions

diff --git a/ymir.nix b/ymir.nix
index 424ca265..74eb1a39 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -15,10 +15,11 @@ let
   };
   myDomains = ["dirty-haskell.org" "www.dirty-haskell.org" "lists.dirty-haskell.org" "l.dirty-haskell.org"
                "files.141.li" "f.141.li" "ymir.141.li" "141.li" "www.141.li" "lists.141.li" "l.141.li"
-               "files.lmu.li" "f.lmu.li" "ymir.lmu.li" "lmu.li" "www.lmu.li" "lists.lmu.li" "l.lmu.li"
                "ymir.xmpp.li" "xmpp.li" "www.xmpp.li" "lists.xmpp.li" "l.xmpp.li"
                "files.yggdrasil.li" "f.yggdrasil.li" "ymir.yggdrasil.li" "git.yggdrasil.li" "www.yggdrasil.li" "yggdrasil.li" "lists.yggdrasil.li" "l.yggdrasil.li"
                "files.praseodym.org" "f.praseodym.org" "ymir.praseodym.org" "praseodym.org" "www.praseodym.org" "lists.praseodym.org" "l.praseodym.org"
+               "ymir.kleen.li" "kleen.li" "www.kleen.li"
+               "ymir.nights.email" "nights.email" "www.nights.email"
               ];
 in rec {
   imports =
@@ -47,12 +48,14 @@ in rec {
   nixpkgs.config.packageOverrides = pkgs:
     rec {
       prosody = pkgs.callPackage ./customized/prosody.nix ({
-          inherit (pkgs.lua51Packages) luasocket luasec luaexpat luafilesystem luabitop luaevent luazlib;
+          inherit (pkgs.lua51Packages) luasocket luaexpat luafilesystem luabitop luaevent luazlib;
+          luasec = lua5_sec;
           lua5 = pkgs.lua5_1;
-          communityModules = ["mod_carbons" "mod_reload_modules"];
+          communityModules = ["mod_carbons" "mod_reload_modules" "mod_csi" "mod_cloud_notify" "mod_csi_pump" "mod_smacks" "mod_track_muc_joins"];
           extraModules = [prosodyAuth];
           extraLibs = [luaPam luaPosix luaSha2];
         });
+      lua5_sec = pkgs.lua5_sec.override { lua5 = pkgs.lua5_1; };
       uwsgi = pkgs.callPackage ./customized/uwsgi.nix {
         extraPlugins = {
           cgi = {
@@ -144,6 +147,7 @@ in rec {
                           9418 # git
                           64738 # murmur
                           53 # DNS
+                          6523 # Obby
                         ];
       allowedUDPPorts = [ 64738 # murmur
                           53 # DNS
@@ -199,6 +203,7 @@ in rec {
                 "nginx"
                 "postfix"
                 "murmur"
+                "infinoted"
               ];
   };
 
@@ -219,6 +224,10 @@ in rec {
                      "auth_custom"
                      "carbons"
                      "reload_modules"
+                     "smacks"
+                     "csi"
+                     "csi_pump"
+                     "cloud_notify"
                    ];
     extraConfig = ''
       reload_modules = { "group", "tls" }
@@ -236,7 +245,7 @@ in rec {
     '';
 
     virtualHosts = builtins.listToAttrs (map (name: { inherit name; value = prosodyVirtHost name; })
-      ["xmpp.li" "yggdrasil.li" "praseodym.org" "141.li"]);
+      ["xmpp.li" "yggdrasil.li" "praseodym.org" "141.li" "nights.email"]);
   };
   security.pam.services."xmpp".text = ''
     auth requisite  pam_succeed_if.so user ingroup xmpp
@@ -348,6 +357,7 @@ in rec {
     postmasterAlias = ""; rootAlias = ""; extraAliases = "";
     virtual = ''
       blog@dirty-haskell.org dirty-haskell@lists.yggdrasil.li
+      @nights.email some@nights.email
     '';
     #destination = ["yggdrasil.li" "ymir.yggdrasil.li" "praseodym.org" "ymir.praseodym.org" "141.li" "ymir.141.li" "xmpp.li" "ymir.xmpp.li" "dirty-haskell.org" "explainuxul.de" "www.explainuxul.de" "lmu.li" "www.lmu.li" "localhost.yggdrasil.li" "localhost"];
     destination = [''regexp:${pkgs.writeText "destination" ''
@@ -355,8 +365,9 @@ in rec {
         /\.?praseodym\.org$/ ACCEPT
         /\.?141\.li$/ ACCEPT
         /\.?xmpp\.li$/ ACCEPT
+        /\.?kleen\.li$/ ACCEPT
         /\.?dirty-haskell\.org$/ ACCEPT
-        /\.?lmu\.li$/ ACCEPT
+        /\.?nights\.email$/ ACCEPT
         /\.?yggdrasil$/ ACCEPT
         /\.?localdomain$/ ACCEPT
         /^localhost$/ ACCEPT
@@ -396,6 +407,8 @@ in rec {
         /@subs?\.(lists?|l)\./ mlmmj-subs:
       ''} regexp:/srv/mail/transport pipemap:{texthash:/srv/mail/discard,static:{discard:}}
 
+      local_recipient_maps = 
+
       luser_relay = gkleen+''${local}
       
       # 10 GiB
@@ -426,7 +439,6 @@ in rec {
         permit_sasl_authenticated,
         reject_non_fqdn_helo_hostname,
         reject_invalid_helo_hostname,
-        reject_unknown_reverse_client_hostname,
         reject_unauth_destination,
         check_client_access regexp:${pkgs.writeText "spfpolicy" ''
           /(^|\.)tu-muenchen\.de$/ DUNNO
@@ -463,6 +475,16 @@ in rec {
 
       alias_maps = texthash:${pkgs.writeText "aliases" ''
         postmaster gkleen
+        webmaster gkleen
+        abuse gkleen
+        noc gkleen
+        security gkleen
+        hostmaster gkleen
+        usenet gkleen
+        news gkleen
+        www gkleen
+        uucp gkleen
+        ftp gkleen
         root gkleen
       ''} texthash:/srv/mail/spm
 
@@ -478,10 +500,23 @@ in rec {
       recipient_canonical_classes= envelope_recipient,header_recipient
     '';
     extraMasterConf = ''
-      uucp            unix - n n - - pipe  flags=Fqhu user=uucp   argv=/var/setuid-wrappers/uux -z -a $sender - $nexthop!rmail ($recipient)
+      uucp            unix - n n - - pipe  flags=Fqhu user=uucp   argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)
       mlmmj           unix - n n - - pipe  flags=ORhu user=mlmmj  argv=${pkgs.mlmmj}/bin/mlmmj-receive -F -L /var/spool/lists/''${user}
       mlmmj-subs      unix - n n - - pipe  flags=ORhu user=mlmmj  argv=${pkgs.mlmmj-exposed}/bin/mlmmj-exposed /var/spool/lists/''${user} ''${extension}
       policy-spf      unix - n n - - spawn            user=nobody argv=${pkgs.pythonPackages.pypolicyd-spf}/bin/policyd-spf ${./ymir/spf.conf}
+      logEmail        unix - n n - 10 pipe flags=Rq   user=nobody null_sender= argv=${pkgs.writeScript "logEmail" ''
+        #!${pkgs.stdenv.shell}
+
+        export PATH=${config.security.wrapperDir}:/run/current-system/sw/bin
+
+        mailFile=/tmp/logEmail/$(date +"%F-%H%M%S").$$
+
+        mkdir -p -m 700 /tmp/logEmail
+
+        cat >$mailFile
+
+        sendmail -G -i "$@" <$mailFile
+      ''} -f ''${sender} -- ''${recipient}
     '';
     networks = ["127.0.0.0/8" "[::ffff:127.0.0.0]/104" "[::1]/128" "10.141.0.0/16"];
   };
@@ -494,6 +529,8 @@ in rec {
                        ".praseodym.org" "praseodym.org"
                        ".141.li" "141.li"
                        ".xmpp.li" "xmpp.li"
+                       ".kleen.li" "kleen.li"
+                       ".nights.email" "nights.email"
                        ".lmu.li" "lmu.li"
                        ".dirty-haskell.org" "dirty-haskell.org"
                      ];
@@ -527,11 +564,23 @@ in rec {
     selector = "ymir";
     configFile = builtins.toFile "opendkim.conf" ''
       Syslog true
-      MTACommand /var/setuid-wrappers/sendmail
+      MTACommand ${config.security.wrapperDir}/sendmail
       LogResults true
     '';
   };
 
+  services.postgrey = {
+    enable = true;
+    socket = {
+      path = "/var/lib/postfix/queue/private/policy-greylist";
+      mode = "0777";
+    };
+    delay = 60;
+    autoWhitelist = 1;
+    maxAge = 7;
+    retryWindow = 1;
+  };
+
   services.dovecot2 = {
     enable = true;
     enableImap = true;
@@ -606,6 +655,35 @@ in rec {
 
   users.extraGroups."mlmmj" = {};
 
+  users.extraGroups."mladmin" = {
+    members = [ "gkleen" ];
+  };
+  
+  users.extraGroups."infinoted" = {
+    members = [ "infinoted" "gitolite" ];
+  };
+
+  security.sudo.extraConfig = ''
+    %mladmin ALL=(mlmmj) NOPASSWD: ALL
+    %infinoted ALL=(infinoted) NOPASSWD: ALL
+  '';
+
+  security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (    action.id == "org.freedesktop.systemd1.manage-units"
+               && action.lookup("unit") == "infinoted.service"
+               && subject.isInGroup("infinoted")
+             ) {
+              return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
+  security.wrappers = { "newgrp".source = "${pkgs.shadow}/bin/newgrp"; };
+
   security.acme = {
     certs = {
       "yggdrasil.li" = {
@@ -616,7 +694,7 @@ in rec {
         extraDomains = builtins.listToAttrs (builtins.map (name: { inherit name; value = "/srv/www/acme/${name}"; }) myDomains);
         postRun = ''
           systemctl reload nginx.service
-          prosodyctl reload
+          ${pkgs.prosody}/bin/prosodyctl reload
         '';
       };
     };
@@ -627,8 +705,8 @@ in rec {
     nodeName = "ymir";
     remoteNodes = ["isaac" "hel"]; # legacy name for odin
     sshUser = {
-      openssh.authorizedKeys.keys = [ ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/var/setuid-wrappers/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgtDHA7oDIaRwggGGznNaKZF68rFTziqefSCn1t9ZKe uucp@odin''
-                                      ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/var/setuid-wrappers/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWBybBQKbPucqBgULQ1phv7IKFWl1Xc4drkCx3D5mIz uucp@hel''
+      openssh.authorizedKeys.keys = [ ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="${config.security.wrapperDir}/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgtDHA7oDIaRwggGGznNaKZF68rFTziqefSCn1t9ZKe uucp@odin''
+                                      ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="${config.security.wrapperDir}/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWBybBQKbPucqBgULQ1phv7IKFWl1Xc4drkCx3D5mIz uucp@hel''
                                     ];
     };
     sshConfig = ''
@@ -694,4 +772,34 @@ in rec {
         forward-addr: 10.141.1.1
     '';
   };
+
+  services.infinoted = {
+    enable = true;
+    keyFile = "/var/lib/acme/yggdrasil.li/key.pem";
+    certificateFile = "/var/lib/acme/yggdrasil.li/fullchain.pem";
+    plugins = [ "note-text" "note-chat" "logging" "autosave" "certificate-auth" "directory-sync" ];
+    extraConfig = ''
+      [certificate-auth]
+      ca-list=/var/lib/infinoted/ca.cert.pem
+      ca-key=/var/lib/infinoted/ca.key.pem
+      accept-unauthenticated-clients=true
+
+      [autosave]
+      interval=5
+
+      [directory-sync]
+      directory=/var/lib/infinoted/dirsync
+      interval=5
+      hook=/var/lib/infinoted/git-sync.sh
+    '';
+  };
+
+  users.extraUsers."infinoted" = {
+    home = "/var/lib/infinoted";
+    createHome = true;
+  };
+
+  services.haveged = {
+    enable = true;
+  };
 }